General
-
Target
176d09bf9afc016df32cb7fbbffa914e75b0b6ed6f25e663f4a79c4dea98ed90
-
Size
2.7MB
-
Sample
220215-sqwsbsgdc2
-
MD5
6f9e9f91b14965908e065cbdc28b3af0
-
SHA1
2eb6c1746a8f4f554dd8aa4d35cd32652b77a154
-
SHA256
176d09bf9afc016df32cb7fbbffa914e75b0b6ed6f25e663f4a79c4dea98ed90
-
SHA512
59595df962b535fe6d30ce705d4451e7e674bd2c42335c49921f3e3f72d087bebe04808766c59cfd4d94ad3a64f6262e14af08233d904f61bab22d9dff58524b
Static task
static1
Behavioral task
behavioral1
Sample
176d09bf9afc016df32cb7fbbffa914e75b0b6ed6f25e663f4a79c4dea98ed90.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
176d09bf9afc016df32cb7fbbffa914e75b0b6ed6f25e663f4a79c4dea98ed90.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
176d09bf9afc016df32cb7fbbffa914e75b0b6ed6f25e663f4a79c4dea98ed90
-
Size
2.7MB
-
MD5
6f9e9f91b14965908e065cbdc28b3af0
-
SHA1
2eb6c1746a8f4f554dd8aa4d35cd32652b77a154
-
SHA256
176d09bf9afc016df32cb7fbbffa914e75b0b6ed6f25e663f4a79c4dea98ed90
-
SHA512
59595df962b535fe6d30ce705d4451e7e674bd2c42335c49921f3e3f72d087bebe04808766c59cfd4d94ad3a64f6262e14af08233d904f61bab22d9dff58524b
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-